Hurricane Katrina Information for Mississippi Hospitals

Are there limits on our ability to disclose information for disaster relief purposes?

If the individual whose information is sought is present and competent, the covered entity may release the information if

• the individual agrees
• the individual does not express an objection
• the covered entity reasonably infers that the individual does not object

If the individual is not present or competent, the covered entity may determine whether the disclosure is in the best interests of the individual and disclose only the PHI that is directly relevant to the individual's healthcare.

A covered entity may forego both of the above requirements if the requirements would interfere with the ability to respond to the emergency circumstances.

For more information see Section 164.510(b) Uses and Disclosures for Involvement in the Individual's Care and Notification Purposes of the Bricker & Eckler Web site.

[ via HIPAA Weekly Advisor ]

HHS issues advisory on Katrina and medical privacy

HHS advised healthcare workers they are allowed to share protected patient information to provide necessary medical care after Hurricane Katrina and are not required to gather patient signatures when sharing information with disaster-relief organizations if obtaining the signatures would hinder the disaster response. The Health Insurance Portability and Accountability Act, which sets standards for patient privacy, allows information sharing to coordinate care with relief workers and to notify family members or responsible parties of a patient's location, general condition and death. It also allows providers to share information with the police and news media for the purpose of locating or identifying responsible parties and allows healthcare facilities to answer inquiries about whether a patient is at the facility, the patient's location within the facility and general condition, HHS said. Read the HHS advisory.

[ via Modern Healthcare ]

HIPAA Rules for Hurrican Katrina

Here is a document just released by the Office of Civil Rights which is helpful about the flexibility with HIPAA under our current circumstances.

Download KATRINAnHIPAA.pdf

HIPAA Privacy Law & Releasing Patient Names for Family Location

From OCR's official FAQs on the HIPAA Privacy Rule:

May a doctor disclose a patient's location or condition to a person who can help notify the patient's family?

Yes. The HIPAA Privacy Rule permits a covered doctor or hospital to disclose protected health information to a person or entity that will assist in notifying a patient's family member of the patient's location, general condition, or death. See 45 CFR 164.510(b)(1)(ii). The patient's written authorization is not required to make disclosures to notify, identify, or locate the patient's family members, his or her personal representatives, or other persons responsible for the patient's care. Rather, where the patient is present, or is otherwise available prior to the disclosure, and has capacity to make health care decisions, the covered entity may disclose protected health information for notification purposes if the patient agrees or, when given the opportunity, does not object. The covered entity may also make the disclosure if it can reasonably infer from the circumstances, based on professional judgment, that the patient does not object. See 45 CFR 164.510(b)(2).

Even when the patient is not present or it is impracticable because of emergency or incapacity to ask the patient about notifying someone, a covered entity can still disclose a patient's location, general condition, or death for notification purposes when, in exercising professional judgment, it determines that doing so would be in the best interest of the patient. See 45 CFR 164.510(b)(3).

Under these circumstances, for example:

• A doctor may share information about a patient's condition with the American Red Cross for the Red Cross to provide emergency communications services for members of the U.S. military, such as notifying service members of family illness or death, including verifying such illnesses for emergency leave requests.
• A hospital may ask police to help locate and communicate with the family of an individual killed or injured in an accident.
• A hospital may contact a patient's employer for information to assist in locating the patient's spouse so that he/she may be notified about the hospitalization of the patient.